Each day, many thousands of new “zombies” join the pool of hijacked PCs (Personal Computers) sending spam to e-mail users and launching Denial of Service (DoS) attacks against e-commerce sites, government resources, and other network infrastructure. In fact, it has been estimated that as many as 170,000 zombie machines are added to the Internet daily. Denial of service (DoS) attacks in particular can cause major service disruptions when limited resources need to be allocated to the attackers instead of to legitimate uses. Such attacks have been estimated to have resulted in over $26,000,000 of losses in calendar year 2004. The attacking machines are usually compromised zombie machines controlled by remote masters, and typically inflict damage by sending vast numbers of IP (Internet Protocol) packets across the Internet directed to the target victim of the attack. The culprits who instigate such attacks range from teenagers aiming to take down small business to international criminal organizations attempting to extort money from large corporations.
Presently, there are two commonly used approaches for defending against such Denial of Service attacks—one which is largely manual and one which is automated. The first approach requires manual identification of the existence of an attack by the end user (i.e., the target victim), followed by a manual (e.g., telephone) report of the attack to the victim's service provider (i.e., carrier), combined with a request that the carrier identify the source of the reported attack and instigate a protective barrier to prevent packets which are part of the attack from getting through the network to the victim. Most typically, such an approach will result in the carrier identifying the source of the offending packets, followed by its refusal to accept any packets from that source (or at least any packets from that source which are destined for the particular attack victim which identified and reported the existence of the attack).
A second approach for defending against such Denial of Service attacks provides a more automated process which requires the service provider to include sophisticated “packet washer” or “scrubber” filters through which each and every packet destined for the end user to be protected must pass. That is, changes are made to the Internet routing tables so that all of the given end user's traffic is routed through such a filter, which examines each packet in turn in an attempt to decide whether the packet is malicious or not. If it does not appear to be malicious, it is forwarded on to the end user, but if it does appear to be malicious, it is filtered out and discarded.
Each of these approaches however have significant limitations. The first approach requires substantial manual intervention and often may not be capable of addressing the problem of an attack until significant damage has already been done. And the second approach is unable to leverage application analysis of packets, since often, only the target is able to extract, and thus analyze, the data contents of the packet. (For example, if cryptographic protocols are used, it is typically only the ultimate destination of the packet that is capable of decoding the encoded packet data.) Moreover, a leveraged attack on a victim's application may not be based only on excessive bandwidth, but rather, may result from certain types of functional requests. Thus, a solution to the problem of Denial of Service attacks is needed wherein the attacks are promptly recognized, identified, and (preferably without manual intervention) stopped.